Do you know where your data is, and can you get it back?

I’ve just shipped my biggest daft wee game yet: Hingmy, a Scottish creature-catching parody. My co-developer and QA department is ten years old, and partway through testing he asked the only question that actually mattered to him: “if I turn it off, are my guys still there?”

To answer him initially i built basic save system (browser storage: on that device, in that browser, gone if you clear your cookies) and proving it comes back (the game validates every saved record on load, and a corrupt file falls back to a fresh start rather than a broken game). A save file, it turns out, is just a backup with feelings.

The first half of that answer bothered me enough that I went back and added an export. You can now lift the whole save out as a file or a short code and load it on another device. Because “it’s saved” actually meant “it’s saved on this one laptop”, which is the same answer a great many organisations would give if you pressed them on where something important lives. A copy you cannae move isn’t much of a copy.

But swap the pixel beasties for customer records, contracts, inspection history, payroll, and his question becomes the two I’d put to any organisation, of any size:

1. Do you know where all your data is stored?

Most organisations can answer for the sanctioned systems: the ERP, the CRM, the document management platform. It’s everything else that should worry you. The forecast that lives in Stevie’s personal OneDrive (ah, but it’s in the cloud, you say!). The customer list exported to Brenda’s desktop “temporarily” three years ago because it was quicker. The SaaS tool a department signed up for with a credit card that IT has never heard of, let alone ever seen. The critical files sitting in a leaver’s personal drive. The supplier holding your data under a contract nobody has read since it was signed.

What happens when Stevie gets a new job, Brenda’s laptop dies, or the card that SaaS tool was bought on expires? It lands on IT to fix regardless.

You cannot protect, recover, or lawfully manage data you haven’t mapped. Every security control, every retention policy, every regulatory obligation quietly assumes an inventory that, in a lot of organisations, doesn’t exist. And when an incident or a subject access request arrives, “we didn’t know it was there” helps you with precisely nobody.

2. And how do you get it back?

Not “do you have backups”. Almost everyone has backups. Can you restore? Have you done it recently, end to end, and timed it? A backup you’ve never restored isn’t a backup; it’s a hope with a file size.

A few uncomfortable specifics worth chasing down:

• Cloud doesn’t mean backed up. Microsoft 365, Google Workspace and most SaaS platforms run on a shared responsibility model: they keep the service up, but protecting your data in it is largely your job. Retention settings are not a backup strategy.
• Recovery objectives should be agreed, not assumed. How much data can each system lose (hours? a day?), and how long can it be down? If IT has picked those numbers on the business’s behalf, the business will find out what they are at the worst possible moment.
• Plan for hostile conditions, not just hardware failure. Ransomware goes for the backups first. If every copy is online and reachable with the same credentials, you may not have the copies you think you have. Immutable or offline copies exist for exactly this.
• Version and test against today’s systems. Data ages; platforms move on. A restore is only useful if something at the other end still understands the shape of what comes back. Schema drift has ruined more recoveries than tape failure ever did.

Questions to ask yourself

• Where is our data (all of it), and when did we last check?
• What would we actually lose if system X failed right now, and who agreed that number?
• When did we last do a full restore, how long did it take, and who pressed the buttons?
• Which SaaS platforms are we assuming someone else is backing up?
• If we were locked out of everything tomorrow, what’s the copy we’d stand recovery on?

Organisations are sometimes resistant to awkward questions. But a ten-year-old’s question is the one you should ask yourselves If I turn it off, are my guys still there? If you can’t confidently answer that for your organisation, that’s the project.

His save file survived QA, by the way. His squad of Hingmies survived a shutdown, and he can carry the lot to his mobile or his tablet if he so wishes. If you fancy auditing my recovery arrangements yourself, away and lose an evening to it.